Help Center

GUI clients (such as Clash Plus and Clash Verge Rev) handle the interface, subscription management, and system settings, while the kernel (mihomo) handles the actual traffic forwarding and rule matching. Mainstream clients all bundle the kernel, so regular users only need to install the client and don't need to download a separate kernel file.

Standalone kernel builds are mainly aimed at server and router use cases, and you can find them in the kernel section of the Get the client page.

The original kernel has stopped receiving updates. Clash Meta is a community fork that added more protocol and rule capabilities. mihomo is the continuation of the Meta project after a rename, so the two share the same lineage.

Mainstream clients today all bundle mihomo, so just pick a client that's still actively updated - the kernel name itself doesn't matter much.

The kernel and the mainstream GUI clients listed on this site are all open-source projects, free to obtain.

Node subscriptions are provided by service providers, and whether they charge is entirely up to the provider, not the client itself.

The client doesn't come with any nodes built in. Subscription links are provided by your service provider through their user dashboard; copy the full link and import it on the client's profile page.

This site only provides client downloads and usage instructions, not subscription services.

Rule mode decides, connection by connection, whether traffic goes direct or through the proxy based on the rules in your config file - this is the recommended mode for everyday use. Global mode routes all traffic through the proxy, while Direct mode routes nothing through it.

When troubleshooting, you can temporarily switch to Global mode to check whether the issue is caused by a rule.

Open-source clients usually don't purchase a commercial code-signing certificate, so SmartScreen may flag the publisher as unknown. After confirming the installer came from this site's download page, click "More info" and then "Run anyway."

If antivirus software quarantined the main program, add the install directory to the allowlist first, then reinstall.

Open System Settings, go to "Privacy & Security," scroll to the bottom, find the blocked app, and click "Open Anyway." The first time you enable Enhanced mode (TUN), the system will also ask you to approve a network extension in the same panel.

You can also remove the quarantine attribute from Terminal:

xattr -dr com.apple.quarantine /Applications/AppName.app

Yes, that's normal. The Android client takes over traffic through the system's VpnService interface, and the first time you tap connect, the system shows a connection request dialog - this is the standard authorization flow, so just tap Allow.

If you accidentally tap Deny, disconnecting and connecting again will bring the prompt back.

Copy the full subscription link from your provider's user dashboard, open the client's Profiles page, paste the link, and click download or import. Once it succeeds, node groups will appear on the proxy page - just pick a node to connect.

See this site's tutorial page for the full step-by-step process.

The iOS client is distributed through the App Store, and Clash Plus is the recommended choice - see its official site at clashplus.io for details.

On first launch, follow the system prompt to allow adding a VPN configuration, then import your subscription link to start using it.

Windows UWP apps are blocked from accessing the local loopback address by default, so they can't reach the local proxy port. Some clients have a built-in UWP loopback helper in their settings - just check the target app to lift the restriction. You can also handle it with a system command:

CheckNetIsolation LoopbackExempt -a -n=AppPackageName

The system proxy only affects apps that respect proxy settings - command-line tools, games, and some desktop software bypass it entirely. TUN mode creates a virtual network adapter and takes over all traffic at the network layer, which handles these cases.

On Windows you need to enable Service mode or run as administrator; on macOS you need to approve the network extension.

Run a latency test on a group from the proxy page - the number represents the HTTP round-trip time to the test URL, which is a useful reference for availability. You can also use a url-test auto-select group, where the kernel periodically tests speed and switches automatically.

Keep in mind low latency doesn't mean high bandwidth; for large-transfer use cases, test actual download speed separately.

Enable both "launch on startup" and "silent start" in the client's settings. On Windows, if you're also using TUN mode, it's best to enable Service mode so you don't get an administrator prompt on every boot.

On mobile, add the client to the system's battery optimization allowlist so it isn't killed in the background.

Yes. On desktop, Rule mode controls routing through domain, IP, and other rules; the Android client usually also supports per-app routing, where you maintain an allow or exclude list in settings.

See the rules and routing entries on this site's terminology reference page for rule syntax.

Check these in order: whether the client's listening port matches the system proxy port (the common default is 7890); whether another proxy tool or browser proxy extension has overridden the setting; on Windows, confirm the address in system proxy settings is 127.0.0.1 and hasn't been overwritten by another program.

Open the client log - if no new connection appears when you browse, traffic isn't reaching the client.

Narrow it down step by step: disconnect the proxy and confirm your local network works; update the subscription in case node info has expired; switch to Global mode to rule out a bad rule; try nodes on a different protocol or port; and finally check the specific error in the log.

If the subscription update also fails, the issue is usually on the provider's end, so contact them to confirm.

First check whether the link is complete and hasn't expired, re-copying it from the provider's dashboard if needed. If your current network can't reach the subscription URL directly, try toggling "update subscription through proxy" in the client's settings and retry.

If the provider changes domains, the old link stops working and you'll need a new one.

A log entry like bind: address already in use means the listening port is taken, usually by a leftover process or another proxy tool holding ports like 7890 or 9090. End the process holding the port, or change mixed-port in the config and restart the client.

On Windows you can locate the offending process with:

netstat -ano | findstr 7890

Adjust these in order: lower the log level to warning or silent; lengthen the auto-update interval for subscriptions and rule sets; turn off scheduled latency tests on groups; on Android, add the client to the battery optimization allowlist so the system doesn't repeatedly kill and restart it.

On iOS, switch to on-demand connection to reduce background overhead.